oss-security - CVE request: vinagre

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Mon, 8 Dec 2008 09:36:49 +0100
From: Tomas Hoger <thoger@...hat.com>
To: OSS Security <oss-security@...ts.openwall.com>
Cc: coley@...re.org
Subject: CVE request: vinagre

vinagre upstream released new upstream versions 0.5.2 and 2.24.2 fixing format
string issue in vinagre_utils_show_error() in src/vinagre-utils.c.

Upstream commits:
Gnome 2.22 branch (0.5.x):
  http://svn.gnome.org/viewvc/vinagre?view=revision&revision=528
Gnome 2.24 branch (2.24.x):
  http://svn.gnome.org/viewvc/vinagre?view=revision&revision=525

I did not have an opportunity what attack vectors exist for this flaw.
Upstream seems to treat is as a security flaw, so probably deserves CVE
name.

Thank you!

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.